CVE-2026-60095 – Vinchin Backup & Recovery 9.0.0.86562 Stack Buffer Overflow via ModuleHandShake

CVE ID :CVE-2026-60095

Published : July 9, 2026, 1:26 p.m. | 22 minutes ago

Description :Vinchin Backup & Recovery through 9.0.0.86562 contains a stack buffer overflow vulnerability in the ModuleHandShake function of the agentlink_server service that allows unauthenticated remote attackers to overwrite the saved return address by supplying an oversized _listen_uuid field that is measured via strlen() and copied without bounds checking into a fixed-length stack buffer using strcpy(). Attackers can send a crafted request with a malicious _listen_uuid value to corrupt the stack and achieve process crash or potential control flow hijack without requiring authentication.

Severity: 6.9 | MEDIUM

Visit the link for more details, such as CVSS details, affected products, timeline, and more…